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IN THE CLAIMS 
Please amend the claims as follows: 
Claims 1-15 (Canceled). 

Claim 16 (Currently Amended): A denial-of-service attack detecting system for 
detecting a denial-of-service attack on a communication device, the denial-of-service attack 
detecting system comprising: 

a monitoring device that monitors [[a]] each packet transmitted to [[a]] the 
communication device that is a target of the denial of servic e attack and includes a traffic 
abnormalitv detecting unit that detects traffic abnormality inform ation indicating an 
abnormality of traffic based on packets transmitted to the commu nication device: 

a performance measuring device that measures response performance of the 
communication device by sending a response request me ssage and is separate from the 
communication device and the monitoring device, the p erformance measuring device 
including a performance abnormality detecting unit that detects performance abnormality 
information indicating an abnormalitv of throughput of the communication device ; and 

an attack determining device that is connected to and performs communication with 
the monitoring device and the performance measuring device, wher e in 

the monitoring dcvico includos a traffic abnormality detecting unit that dotocto traffic 
abnormality information indicating an abnormality of traffic duo to the packet with roGpoct to 
the communication device, 

the p o rformanco moasuring device includ e s a porformanco abnormality d e tecting unit 
that d e tects performance abnormality information indicating an abnormality of throughput of 
the communication device, and 
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the attack determining device includ e s including an effects determining unit that 

determines whether the communication device has received the denial-of-service attack, 

based on using both the traffic abnormality information and the performance abnormality 

information , and 

the effects determining unit determining that the communication device has received 
the denial-of-service attack, when it is determined that one of the traffic abnormality 
information and the performance abnormality information causes an occurrence of one of the 
traffic abnormality information and the performance abnormality information based on an 
abnormality occurrence time included in the traffic abnormality information and the 
performance abnormality information . 

Claim 17 (Previously Presented): The denial-of-service attack detecting system 
according to claim 16, wherein 

the monitoring device further includes a traffic-abnormality-information transmitting 
unit that transmits the traffic abnormality information to the attack determining device. 

Claim 18 (Previously Presented): The denial-of-service attack detecting system 
according to claim 16, wherein 

the performance measuring device further includes a performance-abnormality- 
information transmitting unit that transmits the performance abnormality information to the 
attack determining device. 

Claim 19 (Previously Presented): The denial-of-service attack detecting system 
according to claim 16, wherein 
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the traffic abnormality detecting unit detects the traffic abnormality information based 
on a predetermined attack detection condition that is set in advance. 

Claim 20 (Currently Amended): The denial-of-service attack detecting system 
according to claim 19, wherein 

the monitoring unit further includes a signature generating unit that generates a 
signature indicating a feature of the a packet attacking the communication device, based on 
the attack detection condition, and 

the traffic abnormality information includes the signature. 

Claim 21 (Currently Amended): The denial-of-service attack detecting system 
according to claim 16, wherein 

the traffic abnormality detecting unit detects the traffic abnormality information based 
on a steady traffic indicating an average traffic of the pack e t packets transmitted to the 
communication device. 

Claim 22 (Previously Presented): The denial-of-service attack detecting system 
according to claim 16, wherein 

the performance abnormality detecting unit detects the performance abnormality 
information based on a predetermined performance abnormality detection condition that is se 
in advance. 

Claim 23 (Currently Amended): The denial-of-service attack detecting system 
according to claim 22, wherein 

the performance abnormality detection condition includes 
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a response time from transmission of [[a]] the response request message to the 
communication device to reception of a response message corresponding to the 
response request message, and 

number of times that the response time exceeds a predetermined threshold. 

Claim 24 (Currently Amended): The denial-of-service attack detecting system 
according to claim 16, wherein 

the performance abnormality detecting unit detects the performance abnormality 
information based on a steady response performance indicating an average response 
performance feature of the communication device. 

Claim 25 (Cancelled). 

Claim 26 (Currently Amended): The denial-of-service attack detecting system 
according to claim 1 6, wherein 

when the effects determining unit determines that the communication device has 
received the denial-of-service attack, the attack determining device transmits the traffic 
abnormality information and the performance abnormality information used for the 
determination to a device for reporting to an operator. 

Claim 27 (Currently Amended): The denial-of-service attack detecting system 
according to claim 1 6, wherein 

each of the traffic abnormality information and the performance abnormality 
information includes a certificate, and 
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the effects determining unit determines whether the communication device has 

received the denial-of-service attack, after performing an authorization based on certificates. 

Claim 28 (Currently Amended): A method of detecting a denial-of-service attack on 
a communication device by using a monitoring device that monitors [[a]] each packet 
transmitted to [[a]] the communication device that is a target of th e d e nial of servic e attack , a 
performance measuring device that measures response performance of the communication 
device bv sending a response request message and is separate from the communication device 
and the monitoring device , and an attack determining device that is connected to and 
performs communication with the monitoring device and the performance measuring device, 
the method comprising: 

traffic abnormality detecting a traffic abnormality using including the monitoring 
device to detect d e t e cting traffic abnormality information indicating an abnormality of traffic 
du e to th e pack e t with r e sp e ct based on packets transmitted to the communication device; 

detecting performance abnormality information d e t e cting including using the 
performance measuring device to detect d e t e cting performance abnormality information 
indicating an abnormality of throughput of the communication device; and 

cffoctG determining effects including using the attack determining device to determine 
determining whether the communication device has received the denial-of-service attack, 
bas e d on using both the traffic abnormality information and the performance abnormality 
information , the determining including determining that the communication device has 
received the denial-of-service attack, when it is determined that one of the traffic abnormality 
information and the performance abnormality information causes an occurrence of one of the 
traffic abnormality information and the performance abnormality information based on an 



6 



Application No. 10/578,868 

Reply to Office Action of 10/22/2008 

abnormality occurrence time included in the traffic abnormality information and the 
performance abnormality information . 

Claim 29 (Currently Amended): The method according to claim 28, further 
comprising: 

transmitting traffic abnormality information transmitting including using the 
monitoring device transmitting to transmit the traffic abnormality information to the attack 
determining device. 

Claim 30 (Currently Amended): The method according to claim 28, further 
comprising: 

transmitting performance abnormality information transmitting including using the 
performance measuring device transmitting to transmit the performance abnormality 
information to the attack determining device. 
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